https
protocol. It can
also be used to provide authentication and secure data exchange between
Prolog processes over the network.
Raw TCP/IP networking is dangerous for two reasons. It is hard to tell whether the body you think you are talking to is indeed the right one and anyone with access to a subnet through which your data flows can `tap' the wire and listen for sensitive information such as passwords, creditcard numbers, etc. Secure Socket Layer (SSL) deals with both problems. It uses certificates to establish the identity of the peer and encryption to make it useless to tap into the wire. SSL allows agents to talk in private and create secure web services.
The SWI-Prolog library(ssl)
library provides an API very
similar to
library(socket)
for raw TCP/IP connections that provides
SSL server and client sockets.
The SWI-Prolog SSL interface is built on top of the OpenSSL library. This library is commonly provided as a standard package in many Linux distributions. The MS-Windows version is built using a binary distribution available from http://www.slproweb.com/products/Win32OpenSSL.html.
A good introduction on key- and certificate handling for OpenSSL can be found at http://www.tldp.org/HOWTO/SSL-Certificates-HOWTO/
An SSL server and client can be built with the following (abstracted) predicate calls:
SSL server | SSL client |
ssl_context/3 | ssl_context/3 |
tcp_socket/1 | tcp_socket/1 |
tcp_accept/3 | tcp_connect/2 |
tcp_open_socket/3 | tcp_open_socket/3 |
ssl_negotiatate/5 | ssl_negotiate/5 |
... | ... |
ssl_exit/1 | ssl_exit/1 |
The library is abstracted to communication over streams, and is not reliant on those streams being directly attached to sockets. The tcp_ ... calls here are simply the most common way to use the library. In UNIX, pipes could just as easily be used, for example.
What follows is a description of each of these functions and the arguments they accept.
server
or client
denotes whether the SSL instance will have a server or client role in
the established connection. With Options various properties
of the SSL session can be defined, some of which required, some
optional. An overview is given below. The handle of the connection is
returned in SSL.
Below is an overview of the Options argument. Some options are only required by the client (C), some are required by the server (marked S), some by both server as client (marked CS).
function(+SSL, -Password)
function(+SSL, +ProblemCertificate, +AllCertificates,
+FirstCertificate +Error)
. Access will be granted iff the
predicate succeeds. See load_certificate for a description of the
certificate terms
certificate_file
described earlier. For a server this option is automatically turned on.
There are some predicates included to provide an API similar to the one exposed by a previous version of the library.
This packages installs the library library(http/http_ssl_plugin.pl)
alongside the http package. This library is a plugin for
library(http/thread_httpd.pl)
that makes the threaded HTTP
server support HTTPS, which is simply HTTP over an SSL socket. The HTTP
server is started in HTTPS mode by adding an option ssl
to http_server/2.
The argument of the ssl
option is an option list passed to
ssl_init/3.
Here is an example that uses the demo certificates distributed with the
SSL package.
https_server(Port, Options) :- http_server(reply, [ port(Port), timeout(60), ssl([ host('localhost'), cacert_file('etc/demoCA/cacert.pem'), certificate_file('etc/server/server-cert.pem'), key_file('etc/server/server-key.pem'), password('apenoot1') ]) | Options ]).
Examples of a simple server and client (server.pl
and
client.pl
as well as a simple HTTPS server (https.pl
)
can be found in the example directory which is located in
doc/packages/examples/ssl
relative to the SWI-Prolog
installation directory. The etc
directory contains example
certificate files as well as a README
on the creation of
certificates using OpenSSL tools.
The OpenSSL libraries are not part of the SWI-Prolog distribution and on systems using packagers with dependency checking, dependency on OpenSSL is deliberatly avoided. This implies that OpenSSL must be installed seperatly before using SSL with a binary distribution of SWI-Prolog. Most modern Linux distributions have an SSL package. An installer for MS-Windows is available from http://www.slproweb.com/products/Win32OpenSSL.html The SWI-Prolog SSL interface is currently built using OpenSSL 0.97b.
When installing from the source, the package configuration
automatically builds the ssl library if a suitable OpenSSL
implementation is found. On Windows systems, OpenSSL must be installed
prior to building SWI-Prolog and rules.mk
must be edited to
reflect the position of the header and libraries if they are not in the
standard search path.
The development of the SWI-Prolog SSL interface has been sponsored by Scientific Software and Systems Limited.